public inbox for gentoo-user@lists.gentoo.org
 help / color / mirror / Atom feed
From: James <wireless@tampabay.rr.com>
To: gentoo-user@lists.gentoo.org
Subject: [gentoo-user] Re: workstation iptables
Date: Wed, 7 Oct 2015 13:23:39 +0000 (UTC)	[thread overview]
Message-ID: <loom.20151007T145510-218@post.gmane.org> (raw)
In-Reply-To: 201510070646.15772.michaelkintzios@gmail.com

Mick <michaelkintzios <at> gmail.com> writes:


> > http://gentoo-en.vfose.ru
> > /wiki/IptablesIptables_and_stateful_firewalls#State_basics

> Start iptables, run the script, stop iptables with '/etc/init.d/iptables >
stop' which will save your rules to /var/lib/iptables/rules-save, 


after starting  iptables, I ran /etc/firewall.sh (the previously published 
script) and the stop with the syntax above::

cat /var/lib/iptables/rules-save 
# Generated by iptables-save v1.4.21 on Wed Oct  7 09:13:59 2015
*mangle
:PREROUTING ACCEPT [16022765:14170972269]
:INPUT ACCEPT [16022479:14170935323]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19311825:1508198446]
:POSTROUTING ACCEPT [19311825:1508198446]
COMMIT
# Completed on Wed Oct  7 09:13:59 2015
# Generated by iptables-save v1.4.21 on Wed Oct  7 09:13:59 2015
*filter
:INPUT DROP [471:17192]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [722751:44404539]
[740388:740719942] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Oct  7 09:13:59 2015


was the ouput. 


> or
> run 'iptables-save /var/lib/iptables/rules-save'.  Add any sysctl changes
> to /etc/sysctl.conf, so that they are permanent.  Re-run the script if 
> you want to change things in it.


sysctl is not set up. I did find this page on that::
https://wiki.gentoo.org/wiki/Procfs

Any suggestions on setting up sysctl for iptables and other future
usage?



> > Any improvements in this basic workstation firewall
> > everything out, nothing in?

> Yes, but such improvements are suggested in subsequent scripts on the 
> same page, e.g. ICMP handling, selective logging, etc.  If all you want
> is "a basic firewall using iptables" for the IPv4 workspace, then what 
> you have will do the job.

I'll test out these mods and give the scripts an added sequential character 
in the name so there can be different ones for easy deployment.

The idea is to keep it as simple as possible, test out scripts and ideas
and put something easy to set up on the gentoo wiki, for all to enjoy.


> > Any good tools to quickly test this firewall from another local
> > workstation?

> nmap -A -T4 -P0 -vvv -p1-65535 XXX.XX.XXX.XX

Worked flawlessly. Very precise syntax (thanks). Here are the highlights::

Not shown: 65534 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.9p1-hpn13v11lpk (protocol 2.0)


Not bad for a quick workstation firewall(s). After I get sysctl setup,
I'll test a few other verssions and post again. Then wikify these
for community consumption.

Thanks

James





  reply	other threads:[~2015-10-07 13:43 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-10-06 19:14 [gentoo-user] workstation iptables James
2015-10-07  5:46 ` Mick
2015-10-07 13:23   ` James [this message]
2015-10-07 20:41     ` [gentoo-user] " Mick
2015-10-07 18:20 ` [gentoo-user] " Tom H
2015-10-07 18:22 ` Alon Bar-Lev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=loom.20151007T145510-218@post.gmane.org \
    --to=wireless@tampabay.rr.com \
    --cc=gentoo-user@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox